Credit Card

How to use CreditCard to submit a payin in Brazil.

Use the following server-side flow to submit a Credit Card payment in Brazil:

1. Tokenize the card details.

2. Submit the payment using the returned card token.

3. If 3DS verification is required, redirect the customer to the returned check_url.

Step 1: Tokenize the card

Send the card details to Pagsmile and obtain a temporary card token.

Endpoint

POST https://security-test.pagsmile.com/card/tokenize

Request body

Parameter	Type	Required	Constraints	Description
app_id	string	Yes	Maximum 32 characters.	Merchant application ID assigned by Pagsmile.
version	string	No	Fixed value: 2.0; defaults to 2.0 when omitted.	API version.
timestamp	string	Yes	Format: yyyy-MM-dd HH:mm:ss; maximum 19 characters.	Time at which the request is sent.
card.card_no	string	Yes	Maximum 32 characters.	Card number.
card.issuer	string	Yes	For example, visa or mastercard.	Card brand.
card.holder.name	string	Yes	Maximum 64 characters.	Name printed on the card.
card.cvv	string	Yes	Maximum 8 characters.	Card security code. Never store this value.
card.valid_thru_year	string	Yes	Four digits in YYYY format.	Card expiration year.
card.valid_thru_month	string	Yes	Two digits from 01 to 12.	Card expiration month.

Request example

{
  "app_id": "161***24",
  "version": "2.0",
  "timestamp": "2026-08-14 13:18:10",
  "card": {
    "card_no": "4****9",
    "issuer": "visa",
    "holder": {
      "name": "****"
    },
    "cvv": "111",
    "valid_thru_year": "2030",
    "valid_thru_month": "10"
  }
}

Response example

{
  "code": "10000",
  "msg": "Success",
  "token": "psct_5a****de"
}

The card token expires one hour after it is created. Use it promptly when submitting the payment.

Step 2: Submit the payment

Use the token returned in Step 1 to create and process the Credit Card payment.

Endpoint

POSThttps://gateway-test.pagsmile.com/trade/pay

Request body

Parameter	Type	Required	Constraints	Description
app_id	string	Yes	Maximum 32 characters. Must match the application used to generate the card token.	Merchant application ID assigned by Pagsmile.
version	string	No	Fixed value: 2.0; defaults to 2.0 when omitted.	API version.
timestamp	string	Yes	Format: yyyy-MM-dd HH:mm:ss; maximum 19 characters.	Time at which the request is sent.
out_trade_no	string	Yes	Maximum 64 characters; must be unique for the merchant application.	Merchant order number.
method	string	Yes	Fixed value: CreditCard.	Payment method.
trade_type	string	Yes	Fixed value: API.	Indicates a direct API payment.
order_amount	decimal	Yes	From 0.01 to 50000.00; maximum two decimal places.	Payment amount.
order_currency	string	Yes	Fixed value: BRL.	Payment currency.
subject	string	Yes	Maximum 128 characters.	Payment subject or order title.
content	string	No	Maximum 255 characters.	Payment description.
notify_url	string	Yes	Must be a valid URL. HTTPS is recommended.	Endpoint that receives asynchronous payment notifications.
return_url	string	No	Must be a valid URL. HTTPS is recommended.	URL to which the customer is redirected after completing the payment flow.
buyer_id	string	Yes	Maximum 128 characters.	Merchant-side customer ID.
timeout_express	string	No	Supports m (minutes), h (hours), d (days), and c (end of the current day). The default is 90m and the maximum is 15d.	Time allowed for the payment to move from the initial state to processing.
token	string	Yes	Must be the unexpired psct_ token returned in Step 1.	Tokenized card details.
user_ip	string	Yes	Valid public IPv4 or IPv6 address.	Customer IP address used for risk assessment.
installments	string	No	Positive integer represented as a string; defaults to 1. Available values depend on the merchant and channel configuration.	Number of installments.
issuer	string	Yes	Must match the card brand, for example visa or mastercard.	Card brand.

Request example

{
  "app_id": "16***4",
  "timestamp": "2026-08-14 14:21:25",
  "out_trade_no": "out_tr***58",
  "method": "CreditCard",
  "order_amount": "0.11",
  "order_currency": "BRL",
  "subject": "descriptor-PAGSMIL*Hype games",
  "content": "trade pay content",
  "trade_type": "API",
  "notify_url": "http://demo.gemini-tiger.cn/callback/success",
  "return_url": "https://www.xcloudgame.com/",
  "buyer_id": "111222",
  "timeout_express": "1c",
  "token": "psct_5a7***de",
  "user_ip": "8.29.109.148",
  "installments": "1",
  "issuer": "visa"
}

Response example

{
  "code": "10000",
  "msg": "Success",
  "prepay_id": "VD****B8",
  "trade_no": "202***56",
  "out_trade_no": "out_t***58",
  "pay_url": "",
  "trade_status": "RISK_CONTROLLING",
  "check_url": "https://checkout-test.pagsmile.com/public/redirect/3ds-direct?prepay_id=b0***6e9&token=psct_c1****39"
}

Complete 3DS verification

When trade_status is RISK_CONTROLLING and check_url is returned:

1. Redirect the customer's browser to the complete check_url returned by Pagsmile.

2. Do not construct or modify the URL or its query parameters.

3. Allow the customer to complete the 3DS challenge or verification flow.

4. Use the payment notification or the Payin Detail API to determine the final payment status.